89.149.185.101
Intelligence Briefing: 89.149.185.101/32
Overview
The IPv4 address 89.149.185.101 was observed as a Low Risk host with a risk score of 25. Ownership data identified the address as belonging to AS3257-NET-MNT (NACNET-EU) within the Ripe registry, geolocated to Germany.
Threat Assessment
Despite the low-risk reputation score, the host was classified as a Suspicious Host due to the presence of low-grade risk indicators. The address was listed on one of eight tested DNSBL feeds. No specific threat campaigns were correlated, and the address was not identified as a known attacker or Tor exit node.
Network and Technical Profile
Network role analysis indicated the host was firewalled with no open ports detected. Service banner scanning returned no data. DNS resolution returned PTR hostnames associated with gtt.net infrastructure. Email authentication records (SPF, DMARC) were present for the associated domain. The BGP origin prefix was identified as 89.149.128.0/18.
Behavioral Analysis
Behavioral monitoring recorded zero honeypot hits, enumeration strikes, or WAF violations. No active incidents were attributed to the address during the observation window.
Recommendation
Analysts were advised to monitor the address. The conflicting indicators between the low-risk reputation and the suspicious host classification warrant continued observation for potential activity changes.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | AS3257-NET-MNT |
| ASN | AS3257 |
| Network Name | NACNET-EU |
| CIDR Block | 89.149.185.0/24 |
| RIR | RIPE |
| Country | DE |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | ae7.lr4-fra6.ip4.gtt.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | ae7.lr4-fra6.ip4.gtt.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Not verified |
| DNSSEC | Not signed |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 25% | 1 | 2 |
| reputation | 0% | 0 | 0 |
| geolocation | 25% | 1 | 1 |
| Overall | 20% | 5 | 6 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-23 04:09:35 UTC |
| Last Seen | 2026-09-23 04:09:35 UTC |
| Profile Built | 2026-09-23 04:41:20 UTC |
| Data Freshness | Live |
| Signal Types | 22 |
| Total Observations | 22 |
Full dossier details are available via our API.